NASA SP-8015 


NASA 

SPACE VEHICLE 
DESIGN CRITERIA 
(GUIDANCE AND CONTROL) 


GUIDANCE AND NAVIGATION 
FOR ENTRY VEHICLES 




NOVEMBER 1968 


NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 


FOREWORD 


NASA experience has indicated a need for uniform criteria for the design of space vehicles. 
Accordingly, criteria are being developed in the following areas of technology: 

Environment 

Structures 

Guidance and Control 
Chemical Propulsion 

Individual components of this work will be issued as separate monographs as soon as they 
are completed. This document, Guidance and Navigation for Entry Vehicles, is one such 
monograph. A list of all monographs in this series issued prior to this one can be found on 
the last page of this document. 

These monographs are to be regarded as guides to design and not as NASA requirements, 
except as may be specified in formal project specifications. It is expected, however, that the 
criteria sections of these documents, revised as experience may indicate to be desirable, 
eventually will become uniform design practices for NASA space vehicles. 

This monograph was prepared by Kaman AviDyne under the cognizance of the Electronics 
Research Center, an ad hoc committee chaired by Prof. Arthur E. Bryson, Stanford 
University. The following members assisted: 


F. J. Carroll 

NASA, Electronics Research Center 

J. Zvara 

Kaman AviDyne 

A. Black 

Boeing Co. 

P. Blatt 

AF Flight Dynamics Laboratory 

R. Bohling 

NASA, Office of Advanced Research and Technology 

M. Burke 

NASA, Flight Research Center 

J. Kanter 

NASA, Office of Advanced Research and Technology 

D. Lickly 

MIT, Instrumentation Laboratory 

R. Morth 

MIT, Instrumentation Laboratory 

D. Rosamond 

McDonnell Douglas Corporation 

R. Wingrove 

NASA, Ames Research Center 


Comments concerning the technical content of these monographs will be welcomed by the 
National Aeronautics and Space Administration, Office of Advanced Research and 
Technology (Code RVA), Washington, D.C. 20546. 

November 1968 


1 


For sale by the Clearinghouse for Federal Scientific and Technical Information 
Springfield, Virginia 22151 — CFSTI price $3.00 


PRECEDING PAGE BLANK NOT FILMED. 


CONTENTS 

Page 

1. INTRODUCTION 1 

2. STATE OF THE ART 2 

2.1 Entry Guidance Methods 

2.2 Mercury Entry Guidance and Navigation 3 

2.2.1 System Hardware and Operation 4 

2.2.2 Flight Experience 4 

2.3 Gemini Entry Guidance and Navigation 6 

2.3.1 System Hardware and Operation 6 

2.3.2 Guidance Technique 

2.3.3 Flight Experience 10 

2.4 Apollo Entry Guidance and Control 12 

2.4.1 System Hardware 12 

2.4.2 System Operation 12 

2.5 ASSET Guidance 17 

2.6 PRIME Guidance 18 

2.7 Summary 19 

3. CRITERIA 20 

3.1 Performance 20 

3.2 Crew Safety 21 

3.3 Additional Considerations 22 

4. RECOMMENDED PRACTICES 23 

4.1 Performance 23 

4.1.1 Entry Flight Profile • 23 

4.1.2 Operational Boundaries 25 

4.1.3 Error Analyses 28 

4.1.4 Mathematical Models for Performance Analysis and Simulation 31 

iii 


Page 


4.2 Crew Safety and Mission Success 31 

4.2.1 Probability of Successful Operation 31 

4.2.2 Single-Point Failure Analysis 31 

4.2.3 Redundancy 32 

4.2.4 Malfunction Detection Systems 33 

4.3 Additional Recommendations 33 

4.4 System Design 34 

4.4.1 Conceptual Design 34 

4.4.2 Preliminary Design 35 

4.4.3 Detail Design and Development 36 

4.4.4 Integration and Tests 37 

REFERENCES 39 


NASA Space Vehicle Design Criteria Documents Issued to Date 


. 43 


GUIDANCE AND NAVIGATION 
FOR ENTRY VEHICLES 


1. INTRODUCTION 


The guidance and navigation (G&N) system for vehicles entering the Earth’s atmosphere 
must provide steering commands which cause the spacecraft to reach the desired landing 
point with specified accuracy without compromising the vehicle structural integrity or 
endangering the crew. Inadequate guidance during entry can cause large deviations from the 
desired touchdown area, excessive aerodynamic heating of the vehicle, deceleration in excess 
of crew tolerance limits, or, in the extreme, the loss of the spacecraft and its crew. 

Important factors that influence the design of entry G&N systems include: 

Entry velocity and flightpath angle 
Vehicle aerodynamic and mass characteristics 
Vehicle heating and loading limitations 
Crew deceleration tolerance limits 
Characteristics of Earth and its atmosphere 
Type of control available 
Type of terminal landing system 

Orbit parameters and location of the desired landing site 
Terminal accuracy requirements 
Crew safety and mission success requirements 
Equipment performance 

Experience has shown that uncertainties in vehicle characteristics, particularly in the 
lift-drag (L/D) ratio, have a profound effect on the guidance performance. Uncertainties in 
atmospheric variations and imperfect execution of retrofire and steering control commands 
also affect guidance performance. Navigation errors arise from initial inertial platform 
alinement errors, gyro drift, accelerometer errors, and inaccurate knowledge of the initial 
position and velocity at the beginning of entry. 

The entry G&N system should make effective use of sensing, data processing, and display 
equipment required for other mission phases, so that a minimum of additional equipment is 
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required for performing the entry G&N function. It should take maximum advantage of 
onboard as well as Earth-derived information to generate the desired flightpath to the 
landing site within specified accuracy requirements. It should be as insensitive as possible to 
uncertainties in those parameters over which the G&N designer has no control, in particular, 
vehicle L/D. Provision for pilot monitoring and participation in entry guidance should be 
included to take maximum advantage of the pilot’s capability. 

The scope of this document is limited to the atmospheric entry phase of flight for vehicles 
with maximum L/D ratios less than 1.5. The end of entry is assumed to occur at 100 000 
feet for horizontal landing vehicles, and at deployment of the terminal landing system 
(parachute, paraglider, etc.) for low L/D vehicles. Some discussion of the deorbit maneuver 
as it affects the entry G&N function is included, but detailed aspects of retrofire for deorbit 
will be covered in a separate monograph dealing with thrusting maneuvers in space. 

The entry G&N system is primarily concerned with the motion of the vehicle center of mass 
along a desired flightpath. It is closely coupled with the entry stabilization and control 
(S&C) system which is concerned with vehicle attitude motions about the center of mass. 
The S&C problem for Earth entry is the subject of another monograph. 


2. STATE OF THE ART 


The state of the art of atmospheric entry G&N is composed of a body of theory coupled 
with actual flight experience characterized by the NASA Mercury, Gemini, and Apollo 
programs, and the USAF ASSET (Aerothermodynamic/elastic Structural Systems Environ- 
mental Tests) and PRIME (Precision Recovery Including Maneuvering Entry) programs. 
Each of these programs is briefly described and appraised. 


2.1 Entry Guidance Methods 


Reference 1 is a comprehensive survey of 98 publications related to the entry guidance 
problem. The guidance methods are presented there under two general classifications: 
guidance using a nominal trajectory and guidance using prediction by either fast-time 
solution or approximate closed-form solution of the equations of motion. The reference 
concludes that the choice of which type to use depends on considerations such as the size 
and speed of the onboard computer, the range of entry conditions which the guidance 
system must be capable of handling, the flexibility to maintain trajectories with desired 
heating or acceleration profiles, and the information that the guidance equations give the 
pilot. It is possible that an entry guidance logic will use elements of both techniques. 
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Guidance about nominal trajectories provides a simple guidance method that can be 
designed to handle many off-design conditions. In this method the state variables along the 
nominal path are precomputed and stored onboard the spacecraft. The variations in the 
measured variables from the stored values are used in the guidance logic either to control the 
spacecraft back to the nominal trajectory (path controller) or to establish a new trajectory 
to reach the destination (terminal controller). For this guidance logic, a desirable nominal 
trajectory must be selected prior to entry. The selection of the nominal may be influenced 
by operational considerations and/or by optimization procedures. 

Constant feedback gains for guidance, or time-varying feedback gains, optimized either as a 
terminal controller or as a path controller about the nominal trajectory may be used. The 
use of many stored trajectories and stored feedback gains implies a large onboard storage 
requirement. Studies have shown that with proper selection of control variables, only a very 
small number of reference trajectories may be necessary for all anticipated entry conditions, 
thus requiring only a modest storage capacity. 

In most cases the method of guidance using fast-time prediction is capable of handling a 
wider variety of entry conditions than the guidance about a nominal trajectory. This 
guidance technique predicts the path by which the vehicle will reach the desired destination 
without violating the heating and acceleration limits. Trajectory prediction may be 
accomplished by a rapid forward integration of the equations of motion for the remainder 
of the flight, or by using an approximate empirical equation derived from many numerical 
solutions to the equations of motion. 

The main advantages of the fast-prediction method are (a) it is able to handle any possible 
flight condition; (b) range prediction as well as the anticipated acceleration or heating 
problems can be obtained from any flight condition; and (c) good display information for 
pilot decisions is provided. 

The principal disadvantage of this method is the requirement for speed in the computer. The 
use of empirical equations reduces the required computational speed and flexibility of the 
guidance system. 

Results of entry G&N studies published subsequent to reference 1 such as references 2 to 7 
reinforce the conclusions of reference 1 concerning the relative advantages or disadvantages 
of the different guidance schemes. 


2.2 Mercury Entry Guidance and Navigation 


The Mercury project utilized retrorockets to deorbit, a ballistic (L/D = 0) configuration 
during entry, and vehicle recovery at sea after terminal descent by parachute. The entry 
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G&N requirements included determination of the orbit, the time of retrofire and the 
direction of retrofire to insure that landing would occur in the desired recovery area. No 
guidance was possible after the deorbit maneuver. However, the vehicle was rolled during 
entry (15° per second after 0.05-g deceleration) to minimize landing dispersions. A brief 
description of the system hardware, operation, and flight experience is presented. More 
detailed information may be found in references 8 to 10. 


2.2.1 System Hardware and Operation 


The system components used for Earth return were the spacecraft clock and a navigational 
reticle. Secondary equipment, which included navigational charts and tables, an altimeter, a 
longitudinal accelerometer, and attitude displays and attitude-rate displays, were available 
for use in contingencies and for entry monitoring. The normal entry sequence was 
controlled by commands from the clock. Manual or ground command retrofiring was 
provided for contingencies. The navigation reticle was an optical device used to check when 
the spacecraft was at the correct attitude for retrofire. Use of the reticle, a landmark, and 
the horizon enabled the astronaut to manually aline the vehicle in pitch, yaw, and roll 
attitude. 

The entry sequence started by positioning the spacecraft to the retrograde attitude of 34° 
pitch, 0° roll or yaw. The three rockets provided a retrograde AV of approximately 500 
ft/sec. 

Following deorbit the spacecraft was positioned to the entry attitude of 1.6° pitch. It was 
maintained in this attitude until a 0.05-g switch indicated entry into the atmosphere. At this 
point attitude hold was cut off and a rate command control mode in roll was initiated, while 
using rate damping in pitch and yaw. This mode was terminated at about 40 000 feet when 
a drogue parachute was deployed to stabilize terminal descent in preparation for main 
parachute deployment at 1 0 000 feet. About 20 minutes elapsed between retrofire and 
landing and a range of approximately 3000 nautical miles was covered. 


The contributions of different parameters to landing point dispersion for a Mercury-type 
ballistic entry vehicle returning from a near-Earth orbit are presented in table I. The sources 
of error listed are considered sufficiently independent that they may be combined as the 
root sum of squares. The data in table I show the relative contributions of the different 
error sources as determined from error analyses. 


2.2.2 Flight Experience 


Apogee, perigee, and landing errors for each of the four manned orbital flights is shown in 
table II. Only the MA-8 entry was performed as planned with the automatic stabilization 
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TABLE I. -Ballistic Entry Vehicle Dispersions 


Error source 

Tolerance 

Dispersion contribution (n. mi.) 

Overshoot 

Undershoot 

Cross-range 

Orbit elements: 
Perigee altitude 
Eccentricity 
Inclination 

±0.5 n. mi. 
±0.0001 
±0.10° 

11.0 

15.6 

11.0 

15.6 

6.0 

Retro attitude: 
Pitch angle 
Yaw angle 

±6.9° 

±8.1° 

65.0 

10.0 

15.0 

Retro velocity 

±2.4% 

85.0 

85.0 

— 

Retro position: 
Downrange 
Cross-range 

±5 n. mi. 
±5 n. mi. 

5.0 

5.0 

5.0 

Drag coefficient 

±10% 

5.8 

5.8 

— 

Atmosphere variation 

±50% 

15.4 

15.4 

— 

Winds 


2.5 

2.5 

4.0 

Root sum of squares 


110.1 

89.4 

17.4 


TABLE II.— Summary of Mercury 
Manned Orbital Flights 


Flight 

Apogee, 
n. mi. 

Perigee, 
n. mi. 

Landing 
error, n. mi. 

MA-6 

140.9 

86.9 

-40 

MA-7 

145 

86.8 

+250 

MA-8 

152.8 

86.9 

-4 

MA-9 

144.2 

87.2 

-1 
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and control system (ASCS) and all associated sensors and thrusters performing correctly. 
In the other flights manual control backup was required because of various problems. 

Flight MA-7 had the largest landing-point error. During most of the flight, the spacecraft 
ASCS performed satisfactorily until, late in the third and final orbital pass, the pilot noted 
the spacecraft true attitude and indicated attitude in pitch were in disagreement. Because 
this control system problem was detected just before retrofire, no corrective action was 
possible and the astronaut was forced to provide manual attitude control, using the window 
and horizon as the attitude reference, for the retrofire maneuver. Retrofire occurred about 3 
seconds late and the optimum spacecraft attitudes were not maintained during retrofire. As 
a result, the spacecraft landed about 250 miles downrange of the planned landing point. 

Similarly, flight MA-9 experienced difficulties with the ASCS that required manual retrofire 
and reentry. However, the pilot was sufficiently forewarned and was able to perform these 
maneuvers with close precision. As seen in table II, MA-9 landed within 1 nautical mile of 
the planned landing area. 


2.3 Gemini Entry Guidance and Navigation 


One of the objectives of the Gemini program was the development of a controlled entry 
capability. A symmetrical body entry vehicle with its center of mass offset from the 
centerline was used. The vehicle thus trimmed at an angle of attack that resulted in an 
average L/D = 0.19. Landing-point control during entry was accomplished by rolling the 
vehicle to give the desired vertical and lateral components of lift. Information on the entry 
G&N aspects of the program presented in references 11 to 1 7 is summarized in the following 
section. 


2.3.1 System Hardware and Operation 

A functional diagram of the entry guidance and control system for Gemini is given in figure 
1 . The G&N portion of the system consisted of a general-purpose digital computer coupled 
to an inertial measurement unit (IMU). 

The digital computer operated at a 500-kilohertz arithmetic bit rate and had a memory 
capacity of 4096 words. After Gemini 7, because of a need to provide flexibility for mission 
planning, an auxiliary magnetic tape memory with storage capacity for several additional 
guidance programs was added. Triply redundant data storage with majority voting was used. 
More than 1 million bits of information could be stored. As mission phases were completed, 
new programs could be transferred from the tape into the computer memory at a rate of 


6 



Figure 1 -Gemini entry guidance and control system functional block diagram. 


600 bits per second. A program stored in computer memory could be verified by comparing 
it with an identical program stored on tape requiring, at most, 6 minutes. 

Data flow and interfaces for the entry G&N system are shown in figure 2. The IMU, 
consisting of a four-gimbal platform, electronics, and power supply, was hard mounted to 
the spacecraft. The inner gimbal supported three orthogonally mounted integrating gyros 
and pendulous accelerometers. The electronics controlled the gimbal servos and converted 
accelerometer signals to pulse form, each pulse representing a change in velocity of about 
0.1 ft/sec. 

The computer sampled the accumulated pulses every computer cycle, applied the necessary 
platform misalinement correction, and included the resulting velocity increment in the 
navigation computations. Prior to retrofire, the platform was alined to the local vertical and 
the orbit plane. The platform was set free at retrofire thereby establishing the inertial 
reference coordinate system. 
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From horizon sensor 


From rate gyros 


Electronic 

timer 


Figure 2.-Gemini entry G&N system data flow. 


The Gemini landing-point control concept used vehicle lift to control range. For maximum 
range the spacecraft maintained a headsdown uplift condition at 0° bank angle. Minimum 
range was obtained using a continuously rolling entry (zero average lift in the vertical plane). 
Downlift at 1 80° bank angle was not used because it led to excessive deceleration and very 
little range reduction. 

Entry control was designed to be performed primarily by the pilot reacting to displayed 
guidance commands. However, an automatic entry control mode was also provided in which 
the computer was directly coupled to the attitude control and maneuver electronics. The 
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onboard computer was updated prior to retrofire with the desired touchdown coordinates 
and the spacecraft’s position and velocity through the digital command system from the 
ground or through the manual data insertion unit. Sequential firing of the four retrorockets, 
initiated automatically when the time to retrofire reached zero, gave a AV of about 320 
ft/sec. The measured retrofire velocity increment was displayed to the crew on the 
incremental velocity indicator. 

Above 400 000-foot altitude, an estimated drag deceleration, based on a stored air density 
profile, superseded the data from the IMU. At a navigated altitude of 400 000 feet, the 
computer again accepted IMU data and began entry guidance computations. When the 
measured drag deceleration reached about 1.0 ft/sec 2 , the computer began generating 
steering commands. At a navigated altitude of 80 000 feet, entry guidance was terminated 
since only negligible maneuver capability remained. After a ballistic descent to an altitude of 
50 000 feet, the drogue chute was deployed to stabilize the spacecraft for main chute 
deployment, which occurred at an altitude of 10 600 feet. 

Table III gives the results of an error analysis made to determine how different errors 
affected Gemini downrange and cross-range touchdown accuracy starting from a 
161-nautical-mile orbit. These data illustrate the relative error contributions of the various 
error sources. 


2.3.2 Guidance Technique 


Two different techniques were developed and used during the Gemini program for steering 
between 400 000 and 80 000 feet: a constant bank angle technique and a zero lift range 
prediction technique (refs. 15 and 16). 

The constant bank angle technique uses a computed bank angle, with sign reversal, for range 
control to an 80 000-foot altitude, to guide the spacecraft along a computed trajectory to 
the target. 

The zero range prediction technique uses lift to null predicted terminal errors as soon as 
possible. When the errors are nulled, a ballistic trajectory (zero lift) is flown to the target. 

The constant bank angle technique is more sensitive to uncertainties in L/D because of its 
proportional nature. If the L/D is seriously lower than predicted, it may dissipate so much 
capability early in the entry that it cannot correct the terminal errors with the available lift 
near the end of the entry. 
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TABLE III.— Representative 3a Errors and Resulting Landing 
Dispersions for Gemini Entry From Orbit 


Error source 

Tolerance 

Dispersion contribution (n. mi.) 

Overshoot 8 

Cross-range 

Retrograde initial conditions: 
Altitude 

2100 ft 

28.6 

3.5 

Velocity 

3 ft/ sec 

39.6 

4.7 

Flightpath angle 

0.015° 

32.8 

4.2 

Azimuth 

0.036° 

-.3 

2.0 

Longitude 

0.012° 

-.6 

.1 

Latitude 

0.003° 

-.1 

.05 

Retrorocket attitude 

O 

q 

90.4 

13.6 

Retrorocket impulse 

3% 

-134.5 

13.6 

Atmospheric density 

60% 

-40.4 

5.3 

Spacecraft weight 

1% 

43.2 

5.2 

Aerodynamic coefficients 

20% 

-27.1 

3.4 

Lift vector orientation 

7.5° 

20.4 

4.0 

Bank angle attitude 

b 

o 

31.1 

.7 

Time of bank reversal 

4 sec late 

-.1 

1.7 

High-altitude winds 


4.6 

.5 

Root sum of squares 


188.0 

22.6 


a Negative sign indicates undershoot. 


2.3.3 Flight Experience 


A summary of the Gemini manned orbital flights is presented in table IV. Total time from 
deorbit to drogue chute deployment on these flights varied from 29.0 to 32.5 minutes. Only 
about 10 percent of this time, however, was available for utilizing the lift capability. 
Approximately 80 percent of the range-control capability occurred at an altitude between 
250 000 and 170 000 feet. The last 20 percent of capability, below 170 000 feet, is very 
important since range prediction becomes more accurate as the target is approached. 

The actual L/D of Gemini III was 35 percent lower than the predicted value. This resulted in 
a loss of approximately 160 nautical miles in the spacecraft’s maneuverability, and 
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TABLE IV.— Summary of Gemini Manned Orbital Flights 


Flight 

Orbit at retrofire 

Guidance 

technique 

Landing 
errors, n. mi. 

Apogee 
n. mi. 

Perigee 
n. mi. 

III 



Zero lift 

a 60 




range 





prediction 


IV 



1 

) 

b 44 

V 



Constant 

C 91 




bank 


VI -A 

161 

161 

1 


7 

VII 

161 

161 

1 

\ 

6.4 

VIII 

161 

161 

Zero lift 

1.1 




range 





prediction 


IX-A 





.4 

X 

215 

161 



3.4 

XI 

165.7 

156.3 



2.6 

XII 

163.6 

159.0 



2.6 


a Pilot directed to ignore guidance commands. 

^Computer failed. 

c Erroneous update from ground. 


contributed to the miss distance of 60 nautical miles. In Gemini VII, a 40-nautical-mile loss 
of maneuverability occurred because of an incorrect computation of the change in 
spacecraft center of mass over the 14-day mission. 

The landing point dispersion pattern is shown in figure 3. The Gemini IV mission had a 
computer failure in orbit necessitating manual entry, rolling at a constant rate of 1 5° per 
second. Thus there was no way to compensate for the preretro and retro errors, and the 
spacecraft landed 44 nautical miles uprange from the intended landing point. 

The Gemini V flight had the largest landing error. This, however, was almost entirely caused 
by a 474-nautical-mile error in navigational update before retrofire. 
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West - n. mi. «- East 


Figure 3.-Relative landing points for Gemini flights. 


Flight experience has indicated that accurate estimates of L/D are very difficult to make. 
The constant bank -angle guidance technique is too sensitive to changes in L/D and hence is 
not recommended. Uncertainty in L/D arises from uncertainty in location of vehicle mass 
center, center of mass variation during flight, and uncertainties in spacecraft aerodynamic 
characteristics. The zero lift range prediction technique does not require a knowledge of the 
spacecraft lift capability, and would steer to a particular target as long as that target was 
within the footprint. 


2.4 Apollo Entry Guidance and Control 


The Apollo entry vehicle, like Gemini, is a symmetrical body with an offset center of mass 
which accomplishes landing-point control by rolling the vehicle. However, the supercircular 
entry velocity of Apollo lunar flights places additional requirements on the entry G&N 
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system. Initial designs of the G&N system were based on a vehicle L/D = 0.5. The average 
L/D on the vehicle flown has been approximately 0.28. Information on the entry G&N 
system presented in references 1 8 to 23 is summarized below. 


2.4.1 System Hardware 


In the Apollo block I design (fig. 4), guidance signals went through the stabilization and 
control (S&C) system to operate the service module propulsion engine and reaction jets; 
hence, a failure in the S&C system would incapacitate the primary guidance system and 
require use of backup procedures. In the block II design (fig. 4) the capability of the 
guidance computer was increased so that it could also perform the S&C task. The block I 
S&C system became a backup system for manual and semiautomatic operation. The block II 
configuration will be used in all lunar flight models. If a malfunction should occur in the 
guidance system, the astronauts will be able to perform many of the guidance functions using 
the S&C system. Block II design uses two nonidentical systems to achieve redundancy. 




Block I system 


Block II system 


Figure 4.-Apollo guidance and control system designs. 
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The block II G&N system consists of the Apollo guidance computer (AGC) coupled to an 
inertial measuring unit (IMU). An electronic time reference system is contained as part of 
the computer. The AGC is a general purpose digital computer with a fixed memory capacity 
of 38 864 words. Memory cycle time is 12 microseconds. Instructions and single-precision 
arithmetic operations are based on a 16-bit word length. 

The original computer design included provisions for onboard maintenance. This feature was 
eliminated since it increased the size and weight of the computer, and made it more 
susceptible to failure (it could not be hermetically sealed and would require more electrical 
connectors). The extremely high reliability of the AGC, coupled with the block II S&C 
backup capability, prompted a decision not to carry a second (backup) guidance computer. 

The primary IMU consists of a three-gimbal inertial platform (containing rate integrating 
gyros and pulse rebalanced pendulous accelerometers), navigation base, system electronics, 
and power supply. Gimbal lock is avoided by occasional gimbal realinement and maneuver 
restrictions. Since the IMU is normally not functioning during the long coasting periods, it is 
alined in flight using a star reference before each acceleration period (thrusting maneuvers or 
atmospheric drag). In the block I design the IMU is supplemented by an orthogonal 
strapped-down gyro system which is used primarily by the S&C system. This system is 
adequate for most guidance functions and it backs up the primary IMU. 

The interface between the AGC and the astronaut navigator is the display and keyboard 
(DSKY). It contains three registers for displaying vector components, each containing five 
decimal digits (which is sufficient to display a 1 5-bit word). Both data and commands are 
entered into the computer via the keyboard. The display is used by the computer to request 
action from the operator and to respond to interrogative commands. 

An entry monitoring system (ref. 23) will enable the astronauts to detect impending 
unacceptable trajectory characteristics such as excessive accelerations or an uncontrolled 
atmospheric skip in sufficient time to prevent their occurrence. This backup system is 
intended to be at least an order of magnitude more reliable than the primary system. It will 
also provide gross range control in the event of a primary guidance system malfunction. The 
basic parts of the system are: 

(1) A signal that is excited when measured acceleration exceeds some nominal value. 

(2) Two signals which are used to indicate whether the flightpath is at the top or bottom 
of the entry corridor. 

(3) A bank angle indicator. 

(4) A flight monitor which presents a plot of vehicle acceleration versus velocity. 
Together with families of curves shown on the plotter face, the astronaut can 
determine whether uncontrollable skipout or excess acceleration is imminent. 
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2.4.2 System Operation 


A typical supercircular entry for the Apollo vehicle can be divided into four areas as shown 
in figure 5. The guidance technique uses predicted capabilities during the initial phases and a 
nominal trajectory during the final phase. 

A flow chart for entry steering is shown in figure 6. Reference 19 contains a detailed 
explanation of the Apollo entry guidance logic for the various phases of flight. 

At atmospheric entry near an altitude of 400 000 feet, the vehicle velocity is about 36 000 
ft/sec. The safe corridor which Apollo must enter (fig. 5) on a lunar return is approximately 
26 nautical miles wide. If the spacecraft enters near the top or bottom of this corridor, the 
lift vector will be directed by banking the vehicle (0° or 180°), so as to drive the spacecraft 
toward the center of the corridor. Phase III is a ballistic lob outside of the atmosphere 
which may be bypassed if the range to the target is short. During phase IV the spacecraft is 
steered to the target. This final phase usually includes the last 600 to 800 nautical miles of 
the entry and is similar to the entry from a near-Earth orbit. This phase terminates at about 
25 000 feet when drogue parachutes are deployed. 


Preentry 
Aline IMU 
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Figure 6.— Apollo entry steering flow chart. 


References 24 and 25 present the results of an investigation of G&N system errors during 
entry on position at parachute deployment for an Apollo-type vehicle. These errors included 
initial condition errors in altitude, altitude rate, range angle and range-angle rate, and 
equipment errors such as accelerometer misalinement angle, gyro-drift rate, accelerometer 
biases, and accelerometer scale factor uncertainties. 

Limited flight experience with the Apollo vehicle indicates that the large uncertainties in 
preflight prediction of L/D remain a problem area as with the Gemini vehicle. 
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2.5 ASSET Guidance 


The unmanned ASSET (Aerothermodynamic/elastic Structural Systems Environmental 
Tests) entry vehicle configuration consisted of a flat-bottomed, 70° delta wing and a cone 
cylinder body on the upper surface. Maximum L/D was 1.2 and W/CpA was 250 lb/ft 2 . A 
liquid ballast system transferred liquid mercury between forward and aft tanks to change 
the vehicle center of mass and hence the trim angle of attack. Detailed data on the guidance 
aspects of the program may be found in references 26 and 27. 

A functional diagram of the ASSET guidance and control (a modified Scout system) is 
shown in figure 7. The guidance and control system performed satisfactorily during five 
suborbital flights, maintaining trajectories down to recovery system deployment within 3 a 
design limits. The only flight malfunctions were intervalometer timing errors which occurred 
during the AEV-1 and AEV-2 flights. The problem was found to be caused by radio 
frequency interference on the input power leads. 

A summary of the trajectory characteristics and the downrange landing errors for the five 
flights is presented in table V. Lateral dispersions were all less than 6 nautical miles right or 



Figure 7.— ASSET guidance and control system. 
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TABLE V.— Summary of Asset Suborbital Flights 


Flight 

Initial 
altitude, ft 

Initial 

velocity, 

ft/sec 

Range, 
n. mi. 

Landing 
error, 
n. mi. 

ASV-l 

200 000 

16000 

942 

-55 

ASV-3 

212 000 

18 000 

1390 

-78 

ASV4 

200000 

19 400 

2300 

-94 

AEV-1 

165 000 

13 000 

844 

-8 

AEV-2 

174 000 

13 000 

742 

-45 


left. The primary factor in the landing-point dispersions was found to be in the differences 
between the predicted and actual trim characteristics. This caused the actual L/D to be 
about 1 0 percent less than the predicted value. 


2.6 PRIME Guidance 


The unmanned PRIME (Precision Recovery Including Maneuvering Entry) flight test 
program was conducted to demonstrate the feasibility of a maneuverable vehicle capable of 
recovering an 80-pound payload from low-Earth orbit with a 3a accuracy of 10 nautical 
miles and with a cross-range maneuver capability of 700 nautical miles. Three flights which 
met this objective were made using an SV-5D entry vehicle with a maximum L/D of 1 .4 and 
W/CpA of 175 lb/ft 2 . Pitch control by means of reaction jets and pitch flap provided 
downrange control. In addition reaction jets provided control in roll and yaw. Detailed data 
on the entry guidance aspects of the program are included in reference 28. 

A functional diagram of the PRIME guidance and control system is shown in figure 8. An 
“acceleration guidance” technique was used. A stored acceleration profile was compared 
with the measured acceleration to generate pitch commands to the autopilot that, in effect, 
changed the vehicle L/D. The modulation of L/D in the pitch plane controlled range of the 
vehicle. Banking the vehicle controlled cross-range maneuvering. 

Advantages of the acceleration guidance technique are simplicity combined with low 
sensitivity of the desired range angle to entry angel and velocity errors, accelerometer 
misalinement, variation in L/D, accelerometer bias, and accelerometer scale factors. The 
disadvantage is that for high accuracy a terminal scheme is required. The technique is 
relatively inflexible. For example, it does not have the capability of commanding any 
required lift to correct for a gross error in retrofire time. Cross-range errors were strongly 
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Figure 8.— PRIME entry guidance and control system. 


dependent on attitude errors and errors in determination of vehicle L/D. As an alternative to 
guidance by the onboard computer/ programer, the vehicle could be controlled through a 
telemetry link. 


2.7 Su m mar y 


For ballistic entry (zero lift), experience with Mercury indicates a state-of-the-art 
landing point accuracy of 20 to 40 nautical miles (la). The main sources of error are 
uncertainties in retrofire AV and retrofire attitude. 

For entry using low L/D (less than 0.5), experience with Gemini indicates a 
state-of-the-art landing-point accuracy of approximately 4 nautical miles (la) where 
the navigation error is 3 nautical miles (la). 
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For unmanned entry using mid-L/D (around 1 .0), experience with ASSET indicates a 
state-of-the-art landing-point accuracy of 50 nautical miles (la). Presumably a 
substantial part of this error could be eliminated by a terminal guidance system. 

For controlled entry with low L/D, the entry G&N system can use the general purpose 
IMU and onboard computer. Only backup and/or monitoring equipment needs to be 
added. 

Uncertainty in vehicle L/D is one of the biggest sources of landing-point error. 

A scheme that nulls predicted landing point error as rapidly as possible is less sensitive 
to L/D uncertainties than a scheme that gradually corrects out landing-point error 
(Gemini). 

Empirical equations for predicting range at zero lift or fractional lift (Gemini) provide 
a simple basis for steering commands. 


3. CRITERIA 


The design of the entry guidance and navigation (G&N) system shall achieve an acceptable 
compromise between errors in terminal conditions and complexity, power consumption, 
weight, volume, and reliability. The guidance scheme shall be insensitive, insofar as 
practicable, to atmospheric and vehicle parameters over which the designer has no control 
and shall accept as large a deviation from nominal conditions as practicable. Crew safety 
shall be accorded first priority in design decisions; however, appropriate emphasis shall be 
accorded to mission objectives. 


3.1 Performance 


The entry G&N system shall be capable of navigating and steering the vehicle, in the 
presence of anticipated perturbations, so that position and velocity errors at the completion 
of entry will not exceed specified values. It shall have a capability for handling anticipated 
off-nominal initial conditions, and for guiding the vehicle to all possible landing sites within 
the accessible region. Terminal accuracy shall be determined by an error analysis which 
includes uncertainties in (1) initial conditions, (2) atmospheric properties, (3) vehicle 
aerodynamic characteristics, (4) changes in aerodynamic characteristics during entry, 
(5) measurements during entry, and (6) the accuracy of implementing desired control. 
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The entry G&N system shall not cause the vehicle to maneuver outside of the allowable 
entry corridor or environment bounds established for the specific mission and spacecraft. 
Specified heat protection limitations such as maximum total heat load on the vehicle, 
maximum total lower or backface surface heating, and peak stagnation heating rates shall 
not be violated. Deceleration limitations that would overload the vehicle structure or cause a 
time-tolerance overload on the crew must not be exceeded. Flightpaths shall be maintained 
within allowable envelopes of maximum dynamic pressure versus load factor and total 
heating versus maximum heating rate. These envelopes shall be established as functions of 
entry flightpath angle, entry velocity, angle of attack, and bank angle. 

A simple logic shall be selected for the entry phase. Verification shall be made that 
computation time for the navigation and steering equations is adequately fast to satisfy the 
operational objectives. Computing accuracies must be consistent with input accuracies and 
terminal accuracy specifications. The selected scheme shall not require excessive reaction 
control fuel and shall use the pilot’s intelligence to maximum advantage. It should provide 
smooth control time histories which are suitable to manual, semiautomatic, or fully 
automatic operation. The control time histories and the trajectory shall be compatible with 
a simple crew monitor concept. The design shall incorporate a technique that allows the 
pilot to easily switch between manual and automatic modes without introducing undesirable 
transients. 

The computer shall include provision for manual and/or automatic data insertion. 
Appropriate checks shall be incorporated in the design to minimize the possibility of 
inadvertent dumping or erasing of the stored program by the crew. Adequate input/output 
provisions shall be included to allow the crew to monitor and communicate with the 
computer. Computer software shall include diagnostic subroutines that facilitate malfunc- 
tion detection. Suitable malfunction indication shall be provided for the crew. The 
reliability of any failure detection hardware or software shall be significantly greater than 
the reliability of the component or operation being monitored. 

For lifting body vehicles descending to a horizontal landing the navigation error at the 
beginning of the terminal guidance phase ( 1 00 000 feet) shall be substantially less than the 
remaining maneuver capability. The entry G&N system shall be closely integrated with the 
terminal G&N system to assure a smooth transition to the terminal phase of flight. 


3.2 Crew Safety 


It shall be demonstrated that the G&N system meets crew safety requirements during 
ground and flight operations. This demonstration shall be validated by a combination of 
analytical and simulation studies, component tests, system tests, and flight tests. All 
anticipated flight configurations and modes of operation shall be considered. Both primary 
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and backup G&N modes shall be verified, with account taken of the effects of single failures 
on the operation of all components and subsystems. 

No single component failure within the G&N system shall preclude accomplishment of the 
functions necessary to provide crew survival. The design shall be such that G&N system 
failures will not adversely affect the operation of the inner stabilization and control loop. 
Partial system failures shall have minimum effect on the total system performance. Specific 
mission and spacecraft reliability requirements such as crew safety probability, mission 
success probability, and mean time between failure during ground and flight operations shall 
be met by the entry G&N system. The reliability of any entry monitor system shall be 
significantly higher than the primary system being monitored. 


3.3 Additional Considerations 


The simplest design capable of performing the required functions shall be provided. The 
number of components shall be minimized along with the total entry G&N system weight, 
volume, and power consumption. Developed and flight-proven equipment, compatible with 
the specific mission and spacecraft objectives, shall be used insofar as practicable. The 
system design shall be versatile and readily adaptable to various entry missions without 
extensive hardware modifications. 

The entry G&N system shall be self-contained and have a capability for performing its 
function without aid from the ground following a position update from the ground shortly 
before retrofire. However, the system should be designed to take advantage of information 
from the ground, where available. The designer shall consider interfaces with the existing 
ground electronics system. Early definition of interface characteristics shall be made and 
strict interface control shall be maintained throughout the design. This shall include 
spacecraft/ground interfaces as well as onboard equipment interfaces. Careful analysis and 
testing of each interface shall be made to insure adequate protection from electromagnetic 
interference (EMI). A comprehensive EMI control plan shall be established early in the 
design to insure that no EMI problems exist in the entry G&N system. A workable G&N 
system electrical grounding philosophy, cognizant of the equipment packaging and its 
distribution throughout the spacecraft, shall be developed early in the design. 

The system design shall not be subject to corona electrical discharges. Immunity to corona 
discharge effects shall be demonstrated during laboratory tests. 

The system shall be designed to be quickly and easily checked and maintained under 
prelaunch conditions. The equipment installation shall be readily accessible so that last 
minute adjustments or repairs can be made if necessary. Provision of sufficient test points 
shall be included to speed checkout and to eliminate the requirement to disconnect 
equipment in order to isolate malfunctions. 
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4. RECOMMENDED PRACTICES 


Procedures and recommended practices for the design of entry G&N systems, and for the 
analysis, simulation, and test of such systems are presented. 


4.1 Performance 


It is imperative that the entry G&N system designer have a definitive statement of the 
problem at the outset. Accordingly, it is recommended that at the inception of a spacecraft 
development program the designer obtain a clear literal description of what the entry G&N 
system is to do. This description will be improved as the design process continues, and 
revised as mission plans change. The primary requirements that will influence the entry 
G&N system are: (1) terminal accuracy requirements, and (2) crew safety and mission 
success requirements. 


4.1.1 Entry Flight Profile 


It is recommended that some typical entry flight profiles be established to serve as design 
baselines for subsequent analysis and synthesis of the entry guidance logic. These profiles 
will depend on the entry vehicle aerodynamic and mass characteristics; vehicle heating and 
loading limitations; crew and/or payload deceleration limits; the Earth and atmospheric 
models used; and the location of the landing site(s) relative to the orbits from which Earth 
return will be made. The entry profiles will also be influenced by the entry velocity and 
flightpath angle, which in turn depend upon the deorbit or midcourse maneuver preceding 
entry, and upon the orbit parameters from which entry will be initiated. 

Entry flight profiles should be established for shallow, steep, and nominal (or middle-of- 
the-corridor) values of entry flightpath angle. The values to use will depend upon the 
particular mission and vehicle characteristics. Methods similar to those presented in 
reference 29 are recommended for establishing entry velocity and flightpath angle limits 
such as those shown in figure 9 (from ref. 30) which illustrates the acceptable values of 
entry flightpath angle and velocity for the Mercury, Gemini, and Apollo vehicles. 

The entry profiles should start from an altitude of 400 000 feet (alternatively, the 0.05-g 
drag deceleration point may be used). The termination of entry will depend on the entry 
vehicle configuration and the type of terminal descent system being used. For low-L/D 
vehicles, the termination of entry is the point where terminal landing devices are deployed. 
For vehicles that can make a conventional airplanelike final descent and landing, it is 
defined as an altitude of 100 000 feet. 
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Figure 9.— Entry velocity and flightpath angle limits. 


24 



A point-mass model of the vehicle and a homogeneous spherical Earth are adequate for 
generating the initial entry profiles (ref. 29). Standard atmosphere information such as that 
described in reference 31 may be used. The profiles can be determined by successively 
improving a trial flight profile. These improvements can be made by cut-and-try or by 
systematic procedures such as those discussed in reference 32. The resulting profiles should 
be well within the limits established by the structure and the crew. 


4.1.2 Operational Boundaries 


It is recommended that operational boundaries within which the entry G&N system must 
perform be defined early in the design. Initially these boundaries will be very approximate, 
but as the program progresses and the vehicle configuration becomes more clearly defined, 
they should be updated. Analyses and simulation studies should be carried out during the 
design to confirm that the entry G&N system does not cause the vehicle to violate any of 
these boundaries. 

The methods described in reference 33 are recommended for determining entry vehicle 
operating boundaries in the altitude-velocity plane. An illustration of such a boundary for a 
lifting entry vehicle is shown in figure 10. If the recovery ceiling shown in the figure is 
exceeded, the vehicle will be flying too slowly to sustain altitude and will be unable to 
check its descent before passing through the lower heating boundary. The area above the 
a max 0° bank curve (established by trim limitations) is characterized by insufficient lift. The 
vehicle can safely pass through this region but it cannot maintain sufficient lift to stay there. 
Flight in the region beneath the heating boundary will lead to excessive heating loads or 
heating rates, depending upon how the boundary is penetrated and the time involved. To 
stay within the operating boundaries it is usually inadvisable for a mid-L/D vehicle to fly at 
an angle of attack below its maximum L/D. 

Simulator and physical tests should be conducted to insure that aerodynamic heating 
constraints will not be exceeded over a reasonable range of off-nominal conditions. The 
techniques of reference 33 may be used for computing ablation rates and heating envelopes 
such as those illustrated in figure 1 1 . Such envelopes should be generated for nominal, 
shallow, and steep entry as functions of maximum L/D, maximum angle of attack and bank 
angle. The data in figure 1 1 from reference 34 indicate that shallow entry causes the largest 
integrated heating load and the steep entry results in the maximum stagnation point heating 
rate. 

Simulator tests should demonstrate that structural limits will not be exceeded over a 
reasonable range of off-nominal operational conditions. The allowable structural loads must 
be determined in cooperation with the structural designers. Dynamic pressure limits may 
occur because of panel flutter, buffeting, or control surface buzz phenomena. Criteria for 
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Figure lO.-Typical entry operating boundaries for lifting entry vehicle. 


panel flutter and buzz are covered in NASA SP-8004 and SP-8003, respectively. If 
aerodynamic control surfaces are used, the angle of attack is limited to the range where trim 
is possible. 

Simulator and physical tests should be conducted to insure that the crew is not subjected 
to excessive acceleration/time conditions during entry. During the initial design phases it is 
recommended that a peak 10-g acceleration limit be used. A more realistic boundary for 
later design phases is presented in figure 12 from reference 35. Because of biological and 
diurnal variability it is difficult to establish rigid limits under all circumstances. Accordingly, 
the boundary shown in figure 12 must be interpreted as approximate (ref. 35). 

Another significant boundary which influences the G&N system is the footprint, which is 
the area on the Earth’s surface that can be reached by the vehicle from specified entry 
conditions. The G&N system design must be such that all landing sites within the footprint 
may be reached. This capability must be demonstrated by simulation studies during the 
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Figure 1 1 .—Typical lifting body entry heating envelopes. 


design. It is recommended that footprints such as those illustrated in figure 13 be 
established by cut-and-try methods (ref. 36) or by systematic procedures (ref. 32). The 
typical footprints in figure 13 from reference 34 illustrate the large effect of small changes 
in entry flightpath angle. Entry from different orbital altitudes changes the entry velocity, 
which also influences the footprint size. The shaded area between the 45° bank and the 75° 
bank angles is considered marginal from an operational standpoint. It is recommended that 
the G&N system steering commands be limited to bank angles less than 45° for mid-L/D 
vehicles. 

Analysis and simulation studies must be carried out continuously throughout the evolution 
of the G&N system design to insure that none of the operational boundaries described 
above are exceeded for any anticipated flight conditions. 
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Figure 12.— Pilot endurance limit for eyeballs in acceleration. 


4.1.3 Error Analysis 


A feedback guidance law should be formulated that will steer the vehicle along, or close to, 
the desired flightpath(s) with acceptable terminal accuracy. Consideration of the type of 
control available during entry should be included in the formulation. Terminal accuracy 
requirements will be verified by conducting error analyses. The recommended procedures 
for doing this include: computer simulation using random inputs (the Monte Carlo 

method); root-sum-square procedures combined with linear analysis of errors caused by 
individual sources (ref. 25); and an extension of the latter procedure called Markov process 
analysis (ref. 32). 

The terminal error is composed of a steering error and a random error. The steering error is 
the terminal miss distance assuming known initial conditions and vehicle parameters, perfect 
navigation and no disturbances. It results from imperfections in the guidance equations and 
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Figure 13.— Typical footprints for lifting body entry vehicle. 


in general is different at every point on the footprint. The steering error at the termination 
of entry should be less than 2 nautical miles. 

The random error is the terminal miss distance over and above the steering error, caused by 
random initial condition errors, in-flight disturbances, instrument measurement errors, and 
uncertainties in vehicle parameters. It is recommended that the following random error 
sources be included in the error analysis: 

1. Initial conditions: 

a. Orbital elements— perigee altitude (+0.5 n. mi.) eccentricity (+0.0001), and inclina- 
tion (±0.1°) 

b. Deorbit position— latitude and longitude (±0.01°) 

c. Attitude during retrofire— pitch and yaw angles (±5° to 10°) 

d. Retrorocket impulse (±2 to 3 percent) 
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2. Measurement errors: 


a. Platform alinement— pitch, yaw, and roll 

b. Gyro errors— random drift, mass unbalance, and anisoelasticity 

c. Accelerometer errors— scale factor and null readings 

d. Altimeter errors 

e. Radar position and/or velocity errors 
3. In-flight disturbances: 

a. Aerodynamic characteristics— L/D (up to ±25 percent) 

b. Vehicle weight (± 1 percent) 

c. Center of mass location (±0.2 in.) 

d. Atmospheric density (exponential variation about standard from ±10 percent at sea 
level to ±60 percent at 300 000 feet) [ref. 37] 

e. High altitude winds— such as in reference 30 

f. Spacecraft attitude— roll (±5°) and pitch (±2°) 

g. Steering command implementation— time delay for manual control (up to 4 seconds) 
[ref. 39] 

h. Roll rate implementation (up to ±2° per second) [ref. 9] 

It is recommended that error analyses be performed for landings at 8 to 10 different 
locations on the footprint. The error analyses should include the effects of the oblate Earth, 
actual orbit inclination, and variations in L/D with Mach number and the viscous parameter, 
V*. In combining the errors, the steering error should be added to the root sum square 
random errors. 

A tradeoff investigation should be made between increased reaction control fuel and 
decreased random terminal error. This can be done by Markov process analysis if 
linearization and additive errors are adequate or by Monte Carlo techniques. 
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4.1.4 Mathematical Models for Performance 
Analysis and Simulation 


The complexity of the mathematical model used for analysis and simulation depends on the 
design phase and on the desired accuracy. Simple models which neglect gravity, atmospheric 
motion, and variable vehicle characteristics are useful in preliminary design and in gaining 
understanding of the effects of the main parameters. The most accurate models should be 
used in final phases of the design including the complete gravitational potential, a rotating 
atmospheric model, wind tunnel derived aerodynamic data, and elastic body effects. 


4.2 Crew Safety and Mission Success 


Early in the design of manned entry vehicles, overall crew safety and mission success goals 
are established. Crew safety goals expressed in probability terms are typically on the order 
of 0.995 to 0.999. Mission success goals may fall in the range 0.90 to 0.95. The entry G&N 
system contribution to the crew safety and mission success probabilities must be 
determined. 

4.2.1 Probability of Successful Operation 


The techniques of references 40 and 41 are recommended for determining the entry G&N 
contribution to crew safety and mission success. The probability of successful operation of 
the entry G&N system should be assessed by using reliability logic diagrams. Component 
reliability test data should be used wherever possible. The level of detail depends upon the 
design phase. Figure 1 4 is a simple first -level diagram showing a section of a possible entry 
G&N system. P is the probability of successful operation of the overall system; P§, PpQ, and 
PgQ are probabilities of successful operation of the components. Further information on 
the steps in the analysis may be found in reference 40. 


4.2.2 Single-Point Failure Analysis 


Single-point failure analysis is a useful tool for determining where redundant elements 
should be used. It consists of examining the effects of a leak, a broken wire, a switch stuck 
between two positions, failure of one transistor, or a broken pin in a connector plug, etc., at 
all points in the system under design. 
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Figure 14.— Example of a first-level entry G&N system reliability logic diagram. 


Identification of all the elements in the G&N system that could fail, the ways in which they 
could fail, and estimation of the probability of such failure are important first steps in 
designing for reliability. The level of detail in this task depends upon the design phase. A 
consistent failure affects analysis, and design policy should be applied to all system elements. 


4.2.3 Redundancy 


The high reliability goals and the multiplicity of components and interconnections in the 
entry G&N system usually require some degree of redundancy in the design. Since 
redundancy is always costly in terms of weight, volume, power consumption, money, and/or 
complexity, the number of redundant elements should be minimized subject to the desired 
reliability goals. Some of the redundancy techniques which may be used in the entry G&N 
system are listed below. The best technique to use for any design will depend on the specific 
mission and spacecraft requirements. 

Triple redundancy.— The outputs of three identical elements are compared or “voted” 
upon. The output will be proper even in the event that one element fails. However it 
requires extra equipment and loses reliability if all three systems must operate for a 
substantial fraction of the time. 

Dual redundancy .— The outputs of two identical elements are compared. Disagreement 
greater than some threshold value causes both elements to shut down. 

Single element with monitor .— Same as dual redundancy except one of the elements is a 
simulation of the functional element. 
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Dual with spare .- Same as dual redundancy except that, upon disagreement, a third 
(spare) element is used. 

Dual with dummy.— A simulation element is compared with two functional elements. 
Failure of one functional element causes output to be taken from the other functional 
element. (Failure of the simulation element is troublesome.) 

Dual with spare dual . -Disagreement in one dual pair causes output to be taken from 
the other dual pair. 


4.2.4 Malfunction Detection Systems 

A malfunction detection system should be considered for catastrophic failure modes. The 
reliability of the monitor should be greater than the reliability of the element being 
monitored. Careful consideration should be given to time lags in detection and to reaction 
times in selecting and implementing alternate modes of operation. The entry monitor 
system (EMS) on the Apollo (ref. 23) not only monitors but also gives enough display 
information to allow a crude, but safe, manual entry. 


4.3 Additional Recommendations 


It is recommended that current estimates of terminal downrange and cross-range error, 
based on present position and velocity, be continuously displayed to the crew. In general, all 
information relating to safety and mission performance available to the computer should 
also be accessible to the crew via displays. 

A configuration control board should be organized early in the design phase to rule on 
whether proposed changes should be allowed and to maintain official records of the current 
configuration design. 

Wherever possible, system elements should be designed for checkout without the necessity 
for direct access. However, access to one system component (that may be malfunctioning) 
should be possible without the necessity of disturbing another component (that may be 
working well). Insofar as practicable, system elements should be designed for blackbox 
interchangeability so that detailed repair or adjustment can be performed in a shop, not on 
the launch pad. 

The designer should attempt to use power in the form in which it is available. Power 
converters should be avoided since they add weight and complexity while they reduce 
efficiency and reliability. 
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4.4 System Design 


The G&N system design will follow a progressive evolution, beginning with the preliminary 
mission and vehicle system planning and ultimately resulting in the operational G&N 
system. The process begins with the conceptual design phase. It progresses through the 
preliminary design, detail design and development, and integration and test phases. Other 
elements such as training, mission planning, and flight tests also come into play. 


4.4.1 Conceptual Design 


In the conceptual design phase various guidance and navigation concepts are investigated in 
a preliminary manner by means of simplified tradeoff analyses to determine which concept 
would best serve the mission and spacecraft requirements. Relatively simple models for the 
important elements of the design analysis are recommended in this phase. Adequate results 
will be obtained by assuming constant gravity, which is effectively a parabolic-Earth 
approximation. This assumption is realistic for the conceptual phase since the radius of the 
Earth compared to the relatively low altitude of the atmospheric entry phase introduces 
only small errors when compared to the inverse square gravity or spherical-Earth 
approximation. 

An exponential density variation and a nonrotating Earth are recommended for the initial 
analysis. Depending on the latitude and heading at entry, the nonrotating Earth assumption 
will cause a slight difference between the inertial velocity and the relative velocity. This 
difference would be about 3 percent for a vehicle at a latitude of 30° N. For later phases of 
the design, the rotation of the Earth should be taken into account. 

Since the vehicle aerodynamic characteristics will not be well defined in the conceptual 
design phase, it is reasonable to assume that the lift and drag are dependent on the dynamic 
pressure and the angle of attack. No sideslip effects need be included. The vehicle may be 
represented by a point mass with two degrees of freedom for planar analyses and three 
degrees of freedom for analyses including lateral maneuvers. Point-mass equations such as 
those presented in reference 42 or 43 may be used. Either a digital or analog simulation is 
acceptable for solving the equations of motion. 

Using the model recommended previously, guidance analyses may be carried out assuming a 
perfect navigation system. This will provide a gross determination of the relative perform- 
ance of different guidance concepts. These comparisons can be made using the design flight 
profiles and the various operational boundaries discussed in section 4.1. In section 2 it was 
pointed out that various concepts for entry guidance have been proposed. These concepts 
involve the sensing and/or application of such parameters as angle of attack, roll angle, 
altitude, altitude rate, temperature, temperature rate, dynamic pressure, etc. The designer 
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must select among these and other possible schemes that concept which will best serve the 
requirements of his specific mission and spacecraft. In analyzing the different concepts, a 
designer must keep in mind the desire for a simple logic which is amenable to either manual 
or automatic operation. 

Different navigation concepts should also be investigated during this phase. The functional 
requirement for the navigation portion of the G&N system is to continuously determine 
three-axis position, velocity, and attitude of the vehicle in a suitable reference frame. Since 
communication blackout limits contact with the ground during critical phases of entry the 
navigation concept must be based on an onboard system such as an inertial platform or 
strapdown system. The conceptual design phase analyses should provide adequate 
information on the different guidance concepts and the different navigation concepts 
investigated to allow the selection of one or two concepts for more detailed study in the 
preliminary design phase. 


4.4.2 Preliminary Design 


In the preliminary design phase v more accurate models will be used to conduct analyses of 
the one or two guidance and navigation concepts which resulted from the conceptual 
studies. The inverse-square gravity (spherical-Earth) assumption should be used in this phase. 
Later this may be improved by using a two-term gravitational potential (oblate-Earth) 
assumption. A standard atmosphere such as described in reference 31 should also be used. 
The lift and drag of the vehicle can be represented by more accurate expressions. A 
point-mass three-degree-of-freedom model may be continued in the preliminary design phase 
for trajectory analysis. However, it is recommended that an analysis using a rigid body 
representation of the vehicle be initiated for the attitude motion analysis. The attitude 
motion analysis should utilize decoupled longitudinal and lateral dynamics to provide 
preliminary results. The development of a more accurate simulation should begin, if possible 
utilizing a hybrid analog/digital computer and a fixed-base cockpit simulator. Initially, the 
simulation should be kept as simple as possible to allow preliminary determination of the 
effectiveness of pilot participation in the guidance loop while avoiding excessive costs. 
Mathematical models of the system concepts may be used during the first stages of the 
simulation, but later as hardware components are developed, they should be incorporated 
into the simulation. 

With the more accurate model described above, the ideal behavior of the combined G&N 
concepts resulting from the conceptual design phase may be analyzed in some detail. Error 
analyses should be carried out as discussed in section 4.1.3. G&N system information flow 
and subsystem interfaces should be defined. Consideration should be given to software 
methods and compatibility with the onboard computer mechanization as defined by total 
mission requirements. Preliminary definition of the mechanization and major components 
of the system should be made. 
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During this phase it is appropriate to initiate reliability analyses as described in section 4.2. 
Identification should be made of any untried features or unique requirements associated 
with the system in order that tests may be planned and carried out to prove the proposed 
mechanization. Preliminary budgets should be established for weight, power, volume, 
reliability, etc. An error budget should be prepared to allocate the total system error among 
the varous system error mechanisms. Such a budget will allow a quantitative preliminary 
performance analysis for comparison with mission requirements. 

Initial man-in-the-loop fixed-cockpit simulation studies should be carried out to provide 
preliminary evaluation of different proposed display concepts and to obtain information on 
how the pilot might best be used in the selected guidance and navigation concept. 
Investigations of system operation near the various operational boundaries should be 
conducted to determine how well the selected system concept functions near the allowable 
limits. 

Coordination with the preliminary design of the other vehicle systems should be carried out 
to insure satisfaction of interface requirements. At the end of this phase a formal review of 
the system design should be held. Approval of the preliminary design and all of its 
supporting analyses will allow initiation of the detail design and development phase. 


4.4.3 Detail Design and Development 


This phase should utilize the most accurate models. The complete gravity potential 
describing the actual Earth should be used in the analyses and simulations. Altitude 
dependence of the atmosphere above an oblate Earth and effects of inclined orbits should 
be included. The best available aerodynamic characteristics either from wind-tunnel tests or 
flight data should be incorporated in the model, including all Mach number variations for 
the lift, drag, and side force coefficients and the roll, pitch, and yaw moment coefficients. 
The analyses and simulations should concentrate on the rigid body, coupled six-degree-of- 
freedom model. For some vehicle configurations, elastic degrees of freedom should also be 
included. As various system components are developed and become available, the actual 
hardware elements should be tied into the man-in-the-loop six-degree-of-freedom simulation. 

The subsystem budgets regarding accuracy, reliability, weight, volume, power, etc. should be 
updated by further simulation studies. These should include extensive investigations of the 
sensitivity of terminal accuracy to uncertainties in initial conditions, the atmosphere, vehicle 
aerodynamic characteristics, measurements, and implementation of control. The capability 
of the system to guide the vehicle to landing sites anywhere in the footprint should be 
verified by man-in-the-loop simulations. Interface specifications between the G&N system 
and other vehicle systems should be formalized so that detail design of all these systems can 
proceed with confidence in their later compatibility. 
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Detailed crew safety and mission success analyses should be carried out in order to 
determine any additional redundancy or backup requirements. The simulation should be 
updated to incorporate as many of the displays as are available. Simulation studies should be 
carried out to verify the adequacy of the displays and the ability of the pilot to participate 
in the guidance to the required extent. Any monitor system to be included should be 
simulated to determine how well the pilot can use it. Procedures for switching over from 
manual to automatic modes should be evaluated. The adequacy of the computer 
input/output unit should be assessed. 

At this point the detail design of the software should start in order to develop a coded 
guidance computer program which should include a program listing of the fixed and erasable 
memory part of the program. Relatively firm mission plans and vehicle system character- 
istics will be required for an effective software design. A definition of the flight program, 
including equations in codable form and computer requirements, such as range of variables 
and compute-cycle constraints, must be prepared. Special engineering simulations should be 
used to investigate and optimize individual areas of the total program such as integration 
routines and filtering methods. 

A final computer compatibility study should be carried out to insure that the software 
requirements are compatible with the selected computer characteristics. The flight equations 
should be tested in a closed-loop flight simulation with the equations programed in a 
convenient computer language. The next step involves the coding of the program in the 
flight computer language and the checkout of the coded program. Tests should be carried 
out to demonstrate that the software, when included as part of the G&N system, is capable 
of guiding the vehicle in all of the anticipated operating modes. 

4.4.4 Integration and Tests 


During this phase the components of the G&N system are mated together to form a 
complete system. Any interface problems must be worked out at this time to insure that the 
integrated system operates as planned in all modes. Tests for electromagnetic interference 
effects should be carried out to verify that no such problems exist. Closed-loop operation of the 
system should be checked for all anticipated mission conditions. Final software tests should 
be conducted to verify the compatibility of the generated commands with the flight 
programs and mission requirements. Complete man-in-the-loop simulations energizing all the 
actual hardware components of the G&N system should be carried out as a final check of 
the system design. 
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